3

I have a REST API built using Java JAX-RS, the API will be exposed to public and it is protected by OAuth 2.0.

I plan to use this API from internal projects I am building and because it is my API, I don't expect the user to authorise me to make calls to this API.

Right now, I am using filters to check access token and validate it against my OAuth Provider, sample of configuration :

<!-- Exposing the facility service as a REST service -->
<jaxrs:server id="restContainer" address="/">
    <jaxrs:serviceBeans>
      .. services beans
    </jaxrs:serviceBeans>
    <jaxrs:providers>
      <ref bean="oauthFilter"/> <-- filter to validate oauth
      <ref bean="apiUsageFilter"/> <-- filter to check api usage (integrated with 3scale)
      <ref bean="jacksonProvider" />
      <ref bean="exceptionMapper" />
    </jaxrs:providers>
    <jaxrs:extensionMappings>
      <entry key="json" value="application/json" />
      <entry key="xml" value="application/xml" />
      <entry key="html" value="text/html" />
    </jaxrs:extensionMappings>
    <jaxrs:features>
      <bean class="org.apache.cxf.feature.LoggingFeature"/>  
    </jaxrs:features>
</jaxrs:server>

I am wondering if I can implement a new filter to check origin of the call, if it is from among the listed ip(s)/domain(s) then bypass oauth, if not, then proceed with oauth.

Is that approach possible ? would it be a good practice? Pros and Cons?

Thanks!

Ahmad Alkhawaja
  • 529
  • 2
  • 12
  • 29
  • Help? :) One of the ideas I got is to implement a filter that allow specific (predefined) app ids (or it is called client ids) to call the API by bypassing oauth interaction, and it works! but the drawback that caller need to specify their client id/secret id in the query string of the call, so if I need to use this in mobile app, it can be easily sniffed by any developer and starting using that id to bypass oauth, and it seems I need to implement a proxy to hide these client ids/secret keys. I really appreciate if anyone has answers about my original question :) – Ahmad Alkhawaja Feb 21 '13 at 11:26

1 Answers1

1

The solution was simple : we implemented Client authorization grant for server-to-server applications, and Resource Owner Credentials authorization grant for mobile apps (that don't have backend) in the OAuth 2.0 server.

Ahmad Alkhawaja
  • 529
  • 2
  • 12
  • 29